Analysis
- max time kernel
151s - max time network
113s - platform
windows10_x64 - resource
win10v20210408 - submitted
26/09/2021, 09:56
Static task
static1
Behavioral task
behavioral1
Sample
11ba4d8cf0672a4fb26246153bace4d6.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
General
- Target 11ba4d8cf0672a4fb26246153bace4d6.exe
- Size 146KB
- Sample210926-lyck4aeehj
- SHA256 e539faa062b0aefbf32f84e2b757fc1e40b2f53eb1aad7fdf942e5b594e63915
- MD5 11ba4d8cf0672a4fb26246153bace4d6
- SHA1 50f558886a3ffac0f398a2d65a6e4b1ae199d655
- SHA512 04dbdd9606d43726bbe0a5e3b48e07cfb59c5085eb9a4da1bfcd599045b8917b2637ab8ae389550b8489c3e383b38972c6a3eb603df5a72e93fc62cdc3d545e8
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://naghenrietti1.top/
-
http://kimballiett2.top/
-
http://xadriettany3.top/
-
http://jebeccallis4.top/
-
http://nityanneron5.top/
-
http://umayaniela6.top/
-
http://lynettaram7.top/
-
http://sadineyalas8.top/
-
http://geenaldencia9.top/
-
http://aradysiusep10.top/
rc4.i32
rc4.i32
Extracted
Family
-
raccoon
Botnet
-
5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4
Attributes
-
url4cnc
https://t.me/agrybirdsgamerept
rc4.plain
rc4.plain
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
- suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
pid Process 1884 7E24.exe 2700 84FB.exe 900 8903.exe - Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 84FB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 7E24.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 7E24.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 84FB.exe - Deletes itself 1 IoCs
pid Process 3024 Process not Found - Loads dropped DLL 5 IoCs
pid Process 900 8903.exe 900 8903.exe 900 8903.exe 900 8903.exe 900 8903.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x000200000001ab10-119.dat themida behavioral2/memory/1884-122-0x0000000001090000-0x0000000001091000-memory.dmp themida behavioral2/files/0x000200000001ab11-125.dat themida behavioral2/memory/2700-129-0x0000000000A90000-0x0000000000A91000-memory.dmp themida - Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7E24.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 84FB.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1884 7E24.exe 2700 84FB.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3628 set thread context of 3880 3628 11ba4d8cf0672a4fb26246153bace4d6.exe 68 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 11ba4d8cf0672a4fb26246153bace4d6.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 11ba4d8cf0672a4fb26246153bace4d6.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 11ba4d8cf0672a4fb26246153bace4d6.exe - Delays execution with timeout.exe 1 IoCs
pid Process 2796 timeout.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3880 11ba4d8cf0672a4fb26246153bace4d6.exe 3880 11ba4d8cf0672a4fb26246153bace4d6.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3024 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3880 11ba4d8cf0672a4fb26246153bace4d6.exe - Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeDebugPrivilege 1884 7E24.exe Token: SeDebugPrivilege 2700 84FB.exe Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3628 wrote to memory of 3880 3628 11ba4d8cf0672a4fb26246153bace4d6.exe 68 PID 3628 wrote to memory of 3880 3628 11ba4d8cf0672a4fb26246153bace4d6.exe 68 PID 3628 wrote to memory of 3880 3628 11ba4d8cf0672a4fb26246153bace4d6.exe 68 PID 3628 wrote to memory of 3880 3628 11ba4d8cf0672a4fb26246153bace4d6.exe 68 PID 3628 wrote to memory of 3880 3628 11ba4d8cf0672a4fb26246153bace4d6.exe 68 PID 3628 wrote to memory of 3880 3628 11ba4d8cf0672a4fb26246153bace4d6.exe 68 PID 3024 wrote to memory of 1884 3024 Process not Found 69 PID 3024 wrote to memory of 1884 3024 Process not Found 69 PID 3024 wrote to memory of 1884 3024 Process not Found 69 PID 3024 wrote to memory of 2700 3024 Process not Found 71 PID 3024 wrote to memory of 2700 3024 Process not Found 71 PID 3024 wrote to memory of 2700 3024 Process not Found 71 PID 3024 wrote to memory of 900 3024 Process not Found 73 PID 3024 wrote to memory of 900 3024 Process not Found 73 PID 3024 wrote to memory of 900 3024 Process not Found 73 PID 900 wrote to memory of 2740 900 8903.exe 74 PID 900 wrote to memory of 2740 900 8903.exe 74 PID 900 wrote to memory of 2740 900 8903.exe 74 PID 2740 wrote to memory of 2796 2740 cmd.exe 76 PID 2740 wrote to memory of 2796 2740 cmd.exe 76 PID 2740 wrote to memory of 2796 2740 cmd.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\11ba4d8cf0672a4fb26246153bace4d6.exe"C:\Users\Admin\AppData\Local\Temp\11ba4d8cf0672a4fb26246153bace4d6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\11ba4d8cf0672a4fb26246153bace4d6.exe"C:\Users\Admin\AppData\Local\Temp\11ba4d8cf0672a4fb26246153bace4d6.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3880
-
-
C:\Users\Admin\AppData\Local\Temp\7E24.exeC:\Users\Admin\AppData\Local\Temp\7E24.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1884
-
C:\Users\Admin\AppData\Local\Temp\84FB.exeC:\Users\Admin\AppData\Local\Temp\84FB.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2700
-
C:\Users\Admin\AppData\Local\Temp\8903.exeC:\Users\Admin\AppData\Local\Temp\8903.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\8903.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:2796
-
-